bcachefs (loop0): scan_for_btree_nodes... bcachefs (loop0): btree node scan found 1 nodes after overwrites done bcachefs (loop0): check_topology... bcachefs (loop0): btree root extents unreadable, must recover from scan bcachefs (loop0): bch2_get_scanned_nodes(): recovery btree=extents level=0 POS_MIN - SPOS_MAX bcachefs (loop0): bch2_get_scanned_nodes(): recovering u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq c70ab18f40f86f94 written 24 min_key POS_MIN durability: 1 ptr: 0:167:0 gen 0 bcachefs (loop0): empty interior btree node at btree=extents level=1 u64s 5 type btree_ptr SPOS_MAX len 0 ver 0, fixing bcachefs (loop0): bch2_btree_repair_topology_recurse(): error ECHILD bcachefs (loop0): empty btree root extents bcachefs (loop0): btree node with incorrect max_key at: btree=alloc level=1 parent: u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 3a29d24e27fd9a2e written 16 min_key POS_MIN durability: 1 ptr: 0:178:0 gen 0 child: u64s 11 type btree_ptr_v2 0:82:0 len 0 ver 0: seq af8d2de42da20fd1 written 16 min_key POS_MIN durability: 1 ptr: 0:141:0 gen 0, fixing bcachefs (loop0): set_node_max(): u64s 11 type btree_ptr_v2 0:82:0 len 0 ver 0: seq af8d2de42da20fd1 written 16 min_key POS_MIN durability: 1 ptr: 0:141:0 gen 0 -> SPOS_MAX bcachefs (loop0): btree root snapshots unreadable, must recover from scan bcachefs (loop0): no nodes found for btree snapshots, continuing done bcachefs (loop0): accounting_read... done bcachefs (loop0): alloc_read... done bcachefs (loop0): snapshots_read... done bcachefs (loop0): check_allocations... bcachefs (loop0): bucket 0:141 data type btree ptr gen 0 missing in alloc btree while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq af8d2de42da20fd1 written 16 min_key R POS_MIN durability: 1 ptr: 0:141:0 gen 0, fixing bcachefs (loop0): bucket 0:178 data type btree ptr gen 0 missing in alloc btree while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 3a29d24e27fd9a2e written 16 min_key POS_MIN durability: 1 ptr: 0:178:0 gen 0, fixing bcachefs (loop0): bucket 0:143 data type btree ptr gen 0 missing in alloc btree while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 5d378a20ed8f0947 written 16 min_key POS_MIN durability: 1 ptr: 0:143:0 gen 0, fixing bcachefs (loop0): bucket 0:164 data type btree ptr gen 0 missing in alloc btree while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq bd007a8741d8c109 written 16 min_key POS_MIN durability: 1 ptr: 0:164:0 gen 0, fixing bcachefs (loop0): bucket 0:170 data type btree ptr gen 0 missing in alloc btree while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq cbff1a530fbe26e1 written 16 min_key POS_MIN durability: 1 ptr: 0:170:0 gen 0, fixing bcachefs (loop0): bucket 0:158 data type btree ptr gen 0 missing in alloc btree while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 1bbb38bb41ebb0c1 written 16 min_key POS_MIN durability: 1 ptr: 0:158:0 gen 0, fixing bcachefs (loop0): bucket 0:180 data type btree ptr gen 0 missing in alloc btree while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq cae06db3fbb516d6 written 8 min_key POS_MIN durability: 1 ptr: 0:180:0 gen 0, fixing bcachefs (loop0): bucket 0:139 data type btree ptr gen 0 missing in alloc btree while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 463d0552c48df05f written 16 min_key POS_MIN durability: 1 ptr: 0:139:0 gen 0, fixing bcachefs (loop0): bucket 0:182 data type btree ptr gen 0 missing in alloc btree while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 7b096ba3ebf8a2de written 16 min_key POS_MIN durability: 1 ptr: 0:182:0 gen 0, fixing bcachefs (loop0): bucket 0:140 data type btree ptr gen 1 missing in alloc btree while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq d3bff37d43c58aa3 written 16 min_key POS_MIN durability: 1 ptr: 0:140:0 gen 1, fixing bcachefs (loop0): bucket 0:173 data type btree ptr gen 0 missing in alloc btree while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 77eb2a5ca4c3315d written 8 min_key POS_MIN durability: 1 ptr: 0:173:0 gen 0, fixing Ratelimiting new instances of previous error done bcachefs (loop0): going read-write bcachefs (loop0): journal_replay... ------------[ cut here ]------------ kernel BUG at fs/bcachefs/btree_iter.c:633! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5353 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:bch2_btree_path_level_init+0xa11/0xa20 fs/bcachefs/btree_iter.c:633 Code: fd 90 0f 0b e8 50 4f 97 fd 90 0f 0b e8 48 4f 97 fd 90 0f 0b e8 40 4f 97 fd 90 0f 0b e8 38 4f 97 fd 90 0f 0b e8 30 4f 97 fd 90 <0f> 0b 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 RSP: 0018:ffffc9000d42eb60 EFLAGS: 00010246 RAX: ffffffff84287b70 RBX: ffff88805450c608 RCX: 0000000000100000 RDX: ffffc9000dd32000 RSI: 00000000000fffff RDI: 0000000000100000 RBP: ffff88803f0551a7 R08: 0000000000000052 R09: 1ffff11007e0aa16 R10: dffffc0000000000 R11: ffffed1007e0aa17 R12: 0000000000000090 R13: 0000000000000000 R14: dffffc0000000000 R15: ffff88803f055000 FS: 00007f3c298376c0(0000) GS:ffff88808d007000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000056288e97c280 CR3: 0000000042c81000 CR4: 0000000000352ef0 Call Trace: btree_path_down fs/bcachefs/btree_iter.c:994 [inline] bch2_btree_path_traverse_one+0x1367/0x21d0 fs/bcachefs/btree_iter.c:1202 bch2_btree_path_traverse_all fs/bcachefs/btree_iter.c:1047 [inline] bch2_trans_begin+0x1379/0x2310 fs/bcachefs/btree_iter.c:3406 bch2_journal_replay+0x170f/0x2630 fs/bcachefs/recovery.c:407 bch2_run_recovery_pass fs/bcachefs/recovery_passes.c:484 [inline] __bch2_run_recovery_passes+0x3ba/0x1060 fs/bcachefs/recovery_passes.c:539 bch2_run_recovery_passes+0x184/0x210 fs/bcachefs/recovery_passes.c:610 bch2_fs_recovery+0x2690/0x3a50 fs/bcachefs/recovery.c:1016 bch2_fs_start+0xaaf/0xda0 fs/bcachefs/super.c:1213 bch2_fs_get_tree+0xb39/0x1520 fs/bcachefs/fs.c:2488 vfs_get_tree+0x8f/0x2b0 fs/super.c:1815 do_new_mount+0x2a2/0x9e0 fs/namespace.c:3808 do_mount fs/namespace.c:4136 [inline] __do_sys_mount fs/namespace.c:4347 [inline] __se_sys_mount+0x317/0x410 fs/namespace.c:4324 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f3c2899066a Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f3c29836e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f3c29836ef0 RCX: 00007f3c2899066a RDX: 0000200000000100 RSI: 0000200000000000 RDI: 00007f3c29836eb0 RBP: 0000200000000100 R08: 00007f3c29836ef0 R09: 0000000000200041 R10: 0000000000200041 R11: 0000000000000246 R12: 0000200000000000 R13: 00007f3c29836eb0 R14: 00000000000049fb R15: 0000200000000040 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:bch2_btree_path_level_init+0xa11/0xa20 fs/bcachefs/btree_iter.c:633 Code: fd 90 0f 0b e8 50 4f 97 fd 90 0f 0b e8 48 4f 97 fd 90 0f 0b e8 40 4f 97 fd 90 0f 0b e8 38 4f 97 fd 90 0f 0b e8 30 4f 97 fd 90 <0f> 0b 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 RSP: 0018:ffffc9000d42eb60 EFLAGS: 00010246 RAX: ffffffff84287b70 RBX: ffff88805450c608 RCX: 0000000000100000 RDX: ffffc9000dd32000 RSI: 00000000000fffff RDI: 0000000000100000 RBP: ffff88803f0551a7 R08: 0000000000000052 R09: 1ffff11007e0aa16 R10: dffffc0000000000 R11: ffffed1007e0aa17 R12: 0000000000000090 R13: 0000000000000000 R14: dffffc0000000000 R15: ffff88803f055000 FS: 00007f3c298376c0(0000) GS:ffff88808d007000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000056288e97c280 CR3: 0000000042c81000 CR4: 0000000000352ef0